前言本篇从零开始安装 ArgoCD配置 Git 仓库连接部署第一个应用让你在30分钟内跑通 GitOps 的完整流程。不是概念讲解是跟着命令一行行操作。一、安装 ArgoCD前置条件# 需要 K8s 集群1.22和 kubectl 已配置 kubectl version --short # Server Version: v1.28.x # 需要一个可访问的 Git 仓库 # 我们用 GitHub 公开仓库做演示安装步骤# 1. 创建命名空间 kubectl create namespace argocd # 2. 安装 ArgoCD稳定版 kubectl apply -n argocd -f \ https://raw.githubusercontent.com/argoproj/argo-cd/stable/manifests/install.yaml # 3. 等待所有 Pod 就绪 kubectl get pods -n argocd -w # NAME READY STATUS RESTARTS # argocd-application-controller-0 1/1 Running # argocd-applicationset-controller-... 1/1 Running # argocd-dex-server-xxx 1/1 Running # argocd-redis-xxx 1/1 Running # argocd-repo-server-xxx 1/1 Running # argocd-server-xxx 1/1 Running # 4. 获取初始密码 kubectl -n argocd get secret argocd-initial-admin-secret \ -o jsonpath{.data.password} | base64 -d # 输出: AbCdEfGhIjKl ← 记住这个密码 # 5. 端口转发访问 UI测试用 kubectl port-forward svc/argocd-server -n argocd 8080:443 # 浏览器访问 https://localhost:8080 # 用户名: admin 密码: 上一步获取的密码生产环境安装Ingress TLS# argocd-ingress.yaml apiVersion: networking.k8s.io/v1 kind: Ingress metadata: name: argocd-server-ingress namespace: argocd annotations: nginx.ingress.kubernetes.io/backend-protocol: HTTPS nginx.ingress.kubernetes.io/ssl-passthrough: true spec: ingressClassName: nginx rules: - host: argocd.mycompany.com http: paths: - path: / pathType: Prefix backend: service: name: argocd-server port: name: https tls: - hosts: - argocd.mycompany.com secretName: argocd-tlskubectl apply -f argocd-ingress.yaml修改默认密码# 安装 ArgoCD CLI curl -sSL -o argocd-linux-amd64 \ https://github.com/argoproj/argo-cd/releases/latest/download/argocd-linux-amd64 sudo install -m 555 argocd-linux-amd64 /usr/local/bin/argocd # 登录 argocd login localhost:8080 --username admin --password 初始密码 --insecure # 修改密码 argocd account update-password # *** Current password: 初始密码 # *** New password: 你的新密码二、配置 Git 仓库连接方式一公开仓库无需认证# 创建 Application直接用公开 Git 仓库 argocd app create myapp \ --repo https://github.com/argoproj/argocd-example-apps \ --path guestbook \ --dest-server https://kubernetes.default.svc \ --dest-namespace default方式二私有仓库需要认证# 1. 创建仓库凭据 argocd repo add https://github.com/myorg/myapp-deploy.git \ --username your-username \ --password your-personal-access-token \ --name myapp-repo # 2. 验证连接 argocd repo list # URL NAME STATUS # https://github.com/myorg/myapp-deploy.git myapp-repo OK方式三SSH 方式推荐生产环境# 1. 生成 SSH 密钥 ssh-keygen -t ed25519 -f ~/.ssh/argocd_repo_key -N # 2. 将公钥添加到 GitHub Deploy Keys cat ~/.ssh/argocd_repo_key.pub # 复制公钥 → GitHub → Settings → Deploy keys → Add deploy key # 3. 在 ArgoCD 中添加仓库 argocd repo add gitgithub.com:myorg/myapp-deploy.git \ --ssh-private-key-path ~/.ssh/argocd_repo_key三、部署第一个应用创建示例应用先在 Git 仓库中准备部署清单# deploy/deployment.yaml (推送到你的 Git 仓库) apiVersion: apps/v1 kind: Deployment metadata: name: demo-app labels: app: demo-app spec: replicas: 2 selector: matchLabels: app: demo-app template: metadata: labels: app: demo-app spec: containers: - name: app image: nginx:1.25-alpine ports: - containerPort: 80 resources: requests: cpu: 50m memory: 64Mi limits: cpu: 200m memory: 128Mi --- apiVersion: v1 kind: Service metadata: name: demo-app spec: selector: app: demo-app ports: - port: 80 targetPort: 80 type: ClusterIP用 CRD 创建 Application# argocd-app.yaml apiVersion: argoproj.io/v1alpha1 kind: Application metadata: name: demo-app namespace: argocd spec: # 源Git 仓库 source: repoURL: https://github.com/myorg/myapp-deploy.git targetRevision: main path: deploy # 目标K8s 集群 destination: server: https://kubernetes.default.svc namespace: default # 同步策略 syncPolicy: automated: prune: true # 自动清理 Git 中已删除的资源 selfHeal: true # 自动修复漂移 syncOptions: - CreateNamespacetrue # 自动创建命名空间# 应用创建 kubectl apply -f argocd-app.yaml # 查看应用状态 argocd app get demo-app # Name: demo-app # Sync Status: Synced (OK) # Health Status: Healthy # Last Sync: 2026-01-15 14:30:00用 CLI 创建 Applicationargocd app create demo-app \ --repo https://github.com/myorg/myapp-deploy.git \ --path deploy \ --revision main \ --dest-server https://kubernetes.default.svc \ --dest-namespace default \ --sync-policy automated \ --auto-prune \ --self-heal四、验证 GitOps 运行测试自动同步# 1. 修改 Git 仓库中的部署清单 # 将 replicas: 2 改为 replicas: 3 git clone https://github.com/myorg/myapp-deploy.git cd myapp-deploy sed -i s/replicas: 2/replicas: 3/ deploy/deployment.yaml git commit -am scale to 3 replicas git push origin main # 2. 等待 30 秒查看 ArgoCD 状态 sleep 30 argocd app get demo-app # Sync Status: Synced # Health Status: Healthy # 3. 验证集群实际状态 kubectl get deployment demo-app # NAME READY UP-TO-DATE AVAILABLE # demo-app 3/3 3 3 # → 副本数已从 2 变为 3自动同步成功测试漂移修复# 1. 手动修改集群模拟有人手动操作 kubectl scale deployment demo-app --replicas1 # 2. 等待 ArgoCD 检测30秒内 sleep 30 # 3. 查看集群状态——已被自动修复 kubectl get deployment demo-app # NAME READY UP-TO-DATE AVAILABLE # demo-app 3/3 3 3 # → 副本数自动恢复为 3漂移修复成功测试回滚# 1. Git revert git revert HEAD git push origin main # 2. 等待 ArgoCD 同步 sleep 30 # 3. 副本数恢复为 2 kubectl get deployment demo-app # demo-app 2/2 2 2 # → 回滚成功踩坑提示ArgoCD 默认每3分钟轮询一次 Git 仓库。如果修改后没有立即同步要么等待3分钟要么配置 Git Webhook 让 ArgoCD 即时响应。五、配置 Git Webhook 加速同步在 ArgoCD 中配置 Webhook# argocd-secret.yamlArgoCD 的 Secret 中添加 Webhook 配置 apiVersion: v1 kind: Secret metadata: name: argocd-secret namespace: argocd labels: app.kubernetes.io/name: argocd-secret app.kubernetes.io/part-of: argocd type: Opaque stringData: # Git Webhook 密钥 webhook.github.secret: your-webhook-secret在 GitHub 中配置 WebhookGitHub → Repository → Settings → Webhooks → Add webhook Payload URL: https://argocd.mycompany.com/api/webhook Content type: application/json Secret: your-webhook-secret Events: Just the push event配置后Git push 后 ArgoCD 在3秒内响应不再等待3分钟轮询。六、本篇要点回顾安装kubectl apply -f install.yaml 获取初始密码 端口转发访问 UI仓库连接公开仓库无需认证私有仓库用 SSH 密钥推荐创建 Application用 CRD 或 CLI配置 sourceGit→ destination集群→ syncPolicy验证三件事自动同步修改 Git → 集群更新、漂移修复手动改集群 → 自动恢复、回滚git revert → 自动回滚Git Webhook让 ArgoCD 即时响应 Git 变更从3分钟变为3秒下一篇预告《核心概念Application、Project 与 Repo Server 详解》——从安装进入概念层面理解 ArgoCD 的核心组件和工作原理。